In JetBrains YouTrack before version 2025.2.92387, a stored XSS vulnerability was identified that could be exploited via Mermaid diagram content. This vulnerability allows attackers to execute arbitrary scripts in the context of a user’s session. The issue is particularly concerning due to its potential impact on confidentiality and integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-57731 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious Mermaid diagram that, when rendered, executes arbitrary JavaScript in the context of the victim’s session. This requires the attacker to trick the victim into viewing the diagram, which can be done through social engineering or by embedding the diagram in a shared document.
Affected Products
- JetBrains YouTrack: A project management and issue tracking tool that allows users to create and manage tasks, which can include Mermaid diagrams.
Mitigation
To mitigate this vulnerability, users should upgrade to JetBrains YouTrack version 2025.2.92387 or later. Additionally, it is recommended to implement input validation and sanitization for user-generated content to prevent the execution of malicious scripts.